{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999576807022095,
        "class": 2
      }
    ],
    "prob": 0.9999577,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9988857,
        "class": 2
      },
      {
        "m": "az/scripts",
        "prob": 0.9990709,
        "class": 1
      },
      {
        "m": "az/javascript",
        "prob": 0.9999577,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T03:39:19Z"
  },
  "path": "20170416_defe03abd03bc238f28294c00d6d2a96.js",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₃(As₂SXe₃)H₃(CmOsPo₂)",
        "k": {
          "source.imports[0]": "ataaa",
          "source.imports[1]": "dfs",
          "source.imports[2]": "dfs.send",
          "source.imports[3]": "emisogh",
          "source.imports[4]": "eval",
          "source.imports[5]": "fontu",
          "source.imports[6]": "fuu1.join",
          "source.imports[7]": "fuuu",
          "source.imports[8]": "ghyt",
          "source.imports[9]": "got",
          "source.strings[0]": "/counter?",
          "source.strings[1]": "00000018MfHYuKa7VWVpznNahopYLbtm9n91mHY4TXN68BCr-V5pY8hfDVZ_eN3cYAto2sj_fIrO0WjzHtA4Zvj-REVtKo6OYs7ENzM_vjMlNcW9WWUn9Et8XnM0",
          "source.strings[2]": "MSXML2.XMLHTTP",
          "source.strings[3]": "abv-mebelshop.ru",
          "source.strings[4]": "inter-mach.ru",
          "source.strings[5]": "mig-inform.ru",
          "source.strings[6]": "ok-happy.ru",
          "source.strings[7]": "yes-xxx.ru",
          "source.strings[8]": "zhttpHER",
          "source.has_imports": true,
          "source.imports[10]": "grohot",
          "source.imports[11]": "guznam",
          "source.imports[12]": "gyt",
          "source.imports[13]": "hunko.open",
          "source.imports[14]": "ijdl",
          "source.imports[15]": "jiki",
          "source.imports[16]": "kjg.split",
          "source.imports[17]": "lub",
          "source.imports[18]": "muhter",
          "source.imports[19]": "pusik",
          "source.imports[20]": "r.indexOf",
          "source.imports[21]": "rima",
          "source.imports[22]": "tjkh",
          "source.imports[23]": "uuu",
          "source.imports[24]": "zaher",
          "source.imports[25]": "zaher.substr",
          "source.functions[0]": "ataaa",
          "source.functions[1]": "fuuu",
          "source.functions[2]": "grohot",
          "source.functions[3]": "muhter"
        },
        "x": 39,
        "id": 0,
        "is": [
          "uuu",
          "ijdl",
          "dfs",
          "pusik",
          "zaher",
          "zaher",
          "zaher.substr",
          "gyt",
          "lub",
          "ghyt",
          "tjkh",
          "grohot",
          "dfs.send",
          "rima",
          "got",
          "fontu",
          "emisogh",
          "r.indexOf",
          "jiki",
          "muhter",
          "guznam",
          "fuuu",
          "ataaa",
          "eval",
          "kjg.split",
          "fuu1.join",
          "hunko.open"
        ],
        "ms": {
          "file": {
            "size": 1361.0
          },
          "text": {
            "tab_count": 64.0,
            "digit_ratio": 0.1,
            "space_count": 125.0,
            "total_lines": 46.0,
            "char_entropy": 5.62,
            "unique_chars": 84.0,
            "import_density": 58.7,
            "string_density": 0.96,
            "avg_line_length": 27.63,
            "max_line_length": 135.0,
            "last_line_length": 57.0,
            "long_token_count": 1.0,
            "most_common_char": "u",
            "whitespace_ratio": 0.2,
            "most_common_ratio": 0.04,
            "identifier_density": 1.87,
            "line_length_stddev": 28.45,
            "normalized_import_count": 3.98,
            "normalized_string_count": 6.49,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.59,
            "trailing_whitespace_lines": 6.0,
            "imports_to_functions_ratio": 6.75,
            "strings_to_functions_ratio": 11.0,
            "suspicious_identifier_ratio": 0.24,
            "normalized_unique_identifiers": 6.16,
            "identifiers_to_functions_ratio": 8.5
          },
          "imports": {
            "total": 27.0,
            "unique_modules": 26.0,
            "third_party_count": 27.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 44.0,
            "avg_length": 10.77,
            "max_length": 124.0,
            "path_count": 2.0,
            "avg_entropy": 1.59,
            "total_bytes": 474.0,
            "domain_count": 10.0,
            "entropy_stddev": 1.71,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {
            "total": 4.0,
            "one_liners": 4.0,
            "avg_name_length": 5.25,
            "no_params_count": 4.0,
            "avg_length_lines": 1.0,
            "max_length_lines": 1.0,
            "min_length_lines": 1.0,
            "density_per_100_lines": 8.7,
            "code_in_functions_ratio": 0.09
          },
          "identifiers": {
            "total": 86.0,
            "avg_length": 4.0,
            "max_length": 13.0,
            "min_length": 1.0,
            "avg_entropy": 1.58,
            "reuse_ratio": 0.4,
            "unique_count": 34.0,
            "length_stddev": 2.21,
            "has_digit_ratio": 0.15,
            "sequential_names": 7.0,
            "single_char_count": 4.0,
            "single_char_ratio": 0.12,
            "all_lowercase_ratio": 0.82,
            "repeated_char_names": 1.0,
            "numeric_suffix_count": 5.0
          }
        },
        "ss": [
          [
            51,
            "MSXML2.XMLHTTP"
          ],
          [
            52,
            "MSXML2.XMLHTTP"
          ],
          [
            119,
            "/"
          ],
          [
            120,
            "/"
          ],
          [
            124,
            "t"
          ],
          [
            125,
            "t"
          ],
          [
            141,
            "p"
          ],
          [
            142,
            "p"
          ],
          [
            146,
            "h"
          ],
          [
            147,
            "h"
          ],
          [
            151,
            "S"
          ],
          [
            152,
            "S"
          ],
          [
            156,
            "a"
          ],
          [
            157,
            "a"
          ],
          [
            161,
            "T"
          ],
          [
            162,
            "T"
          ],
          [
            170,
            "PLKU"
          ],
          [
            171,
            "PLKU"
          ],
          [
            193,
            "GETA"
          ],
          [
            194,
            "GETA"
          ],
          [
            249,
            "zhttpHER"
          ],
          [
            250,
            "zhttpHER"
          ],
          [
            300,
            "inter-mach.ru"
          ],
          [
            301,
            "inter-mach.ru"
          ],
          [
            316,
            "ok-happy.ru"
          ],
          [
            317,
            "ok-happy.ru"
          ],
          [
            330,
            "mig-inform.ru"
          ],
          [
            331,
            "mig-inform.ru"
          ],
          [
            346,
            "abv-mebelshop.ru"
          ],
          [
            347,
            "abv-mebelshop.ru"
          ],
          [
            365,
            "yes-xxx.ru"
          ],
          [
            366,
            "yes-xxx.ru"
          ],
          [
            389,
            "00000018MfHYuKa7VWVpznNahopYLbtm9n91mHY4TXN68BCr-V5pY8hfDVZ_eN3cYAto2sj_fIrO0WjzHtA4Zvj-REVtKo6OYs7ENzM_vjMlNcW9WWUn9Et8XnM0"
          ],
          [
            390,
            "00000018MfHYuKa7VWVpznNahopYLbtm9n91mHY4TXN68BCr-V5pY8hfDVZ_eN3cYAto2sj_fIrO0WjzHtA4Zvj-REVtKo6OYs7ENzM_vjMlNcW9WWUn9Et8XnM0"
          ],
          [
            542,
            "/"
          ],
          [
            543,
            "/"
          ],
          [
            740,
            "/counter?"
          ],
          [
            741,
            "/counter?"
          ],
          [
            1068,
            "a"
          ],
          [
            1069,
            "a"
          ]
        ],
        "sz": 1361,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 46.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "Decoded property function alias",
            "e": [
              "var guznam = pusik[9]"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::decoded-property-function-alias",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "split() function wrapper",
            "e": [
              "return kjg.split(lki);"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-split-wrapper",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              "split"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-decode-then-reverse-split--rx-9",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "JavaScript length property",
            "e": [
              "length"
            ],
            "i": "metadata/lang/scripted::length-prop",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Infinite loop structure (e.g. for(;;) or while(1))",
            "e": [
              "while(true)"
            ],
            "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Sequential source identifier names",
            "e": [
              "identifiers.sequential_names = 7.00"
            ],
            "i": "metadata/file/text/profile::sequential-identifiers",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Variable-based split with token delimiter",
            "e": [
              ".split(lki)"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-var-split-marker",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ADODB.Stream Open method call",
            "e": [
              ".open("
            ],
            "i": "micro-behaviors/fs/write/stream::adodb-open",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "ActiveXObject instantiation call",
            "e": [
              "new ActiveXObject("
            ],
            "i": "objectives/execution/interpreter/script/wsh::activexobject-call",
            "l": 1
          },
          {
            "a": "T1036.008",
            "c": 0.949999988079071,
            "d": "Filename has .js extension",
            "e": [
              "20170416_defe03abd03bc238f28294c00d6d2a96.js"
            ],
            "i": "objectives/evasion/masquerade/extension/shebang::js-extension-name",
            "l": 1,
            "m": "F0008"
          },
          {
            "c": 1.0,
            "d": "JavaScript file basename",
            "e": [
              "20170416_defe03abd03bc238f28294c00d6d2a96.js"
            ],
            "i": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "split"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-then-eval--rx-13",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "ClickFix copy-paste action word",
            "e": [
              "open"
            ],
            "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word",
            "l": 1,
            "m": "B0024"
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "WebSocket sends data to peer",
            "e": [
              ".send("
            ],
            "i": "micro-behaviors/communications/websocket/server::websocket-send",
            "l": 3,
            "m": "C0002"
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "Hardcoded .ru domain",
            "e": [
              "\"inter-mach.ru\""
            ],
            "i": "objectives/command-and-control/infrastructure/domain/heuristic::hardcoded-domain-ru",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.800000011920929,
            "d": "Generic XMLHTTP CLSID reference",
            "e": [
              "MSXML2.XMLHTTP"
            ],
            "i": "micro-behaviors/os/com/object::clsid-xmlhttp-generic",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "ActiveXObject string presence",
            "e": [
              "ActiveXObject"
            ],
            "i": "micro-behaviors/process/interpreter/jscript::activex-object",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.9300000071525574,
            "d": "Regex component marker",
            "e": [
              "split"
            ],
            "i": "objectives/anti-static/obfuscation/string/reverse::js-reverse-split-then-decode--rx-4",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Regex component marker",
            "e": [
              "ghyt = false;"
            ],
            "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976",
            "l": 1
          },
          {
            "a": "T1202",
            "c": 0.800000011920929,
            "d": "new ActiveXObject pattern",
            "e": [
              "new ActiveXObject("
            ],
            "i": "objectives/execution/activex/com::activex-object-create-literal",
            "l": 3,
            "m": "E1243"
          },
          {
            "c": 0.800000011920929,
            "d": "URL path fragment 'unte' (part of /counter/)",
            "e": [
              "/counter?"
            ],
            "i": "objectives/command-and-control/channel/http/uri::uri-fragment-counter-path-unte",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "MSXML2.XMLHTTP COM ProgID string",
            "e": [
              "MSXML2.XMLHTTP"
            ],
            "i": "objectives/execution/interpreter/script/wsh::xmlhttp-progid",
            "l": 3
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "join("
            ],
            "i": "micro-behaviors/fs/file/read::require-cwd-package-json--rx-4",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "indexOf"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::management-id-comparison--rx-8",
            "l": 1
          },
          {
            "a": "T1552.001,T1082,T1041",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "info"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-4",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "ActiveXObject usage (JScript/VBScript)",
            "e": [
              "ActiveXObject("
            ],
            "i": "objectives/command-and-control/dropper/builder::activex-object-dup",
            "l": 1
          },
          {
            "a": "T1059.007",
            "c": 0.9300000071525574,
            "d": "Token-array MSXML2 XML fragment",
            "e": [
              "MSXML2.XML"
            ],
            "i": "objectives/command-and-control/dropper/execution/string-reconstruct::token-array-msxml-xml-fragment",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "eval/Function call inside flatted-shaped file",
            "e": [
              "eval("
            ],
            "i": "well-known/lib/flatted::flatted-tamper-eval",
            "l": 1
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "send"
            ],
            "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12",
            "l": 1
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "eval on decoded variable",
            "e": [
              "eval(ziyter)"
            ],
            "i": "objectives/execution/interpreter/eval/dynamic::array-eval-variable",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "eval() function call (raw)",
            "e": [
              "eval"
            ],
            "i": "micro-behaviors/process/interpreter/eval::js-eval-raw",
            "l": 3
          },
          {
            "a": "T1195.002",
            "c": 0.9700000286102295,
            "d": "Empty catch hides loader errors",
            "e": [
              "catch(e)\r\n\t{\r\n\t}"
            ],
            "i": "objectives/supply-chain/trojanized/library/hidden-dep::swallowed-loader-errors",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.75,
            "d": "eval() with dynamic argument",
            "e": [
              "eval"
            ],
            "i": "objectives/supply-chain/hidden-payload/staging::eval-function-call-arg",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "Access to HTTP response body (.responseText)",
            "e": [
              ".responseText"
            ],
            "i": "micro-behaviors/communications/http/client/response-body::response-text",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Tiny XMLHTTP fragment (variant 2)",
            "e": [
              ".XMLHT"
            ],
            "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.7200000286102295,
            "d": "Mixed hexadecimal and decimal operations",
            "e": [
              "50",
              "50+450",
              "1+1",
              "450",
              "1"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/hex::mixed-hex-decimal",
            "l": 3,
            "m": "B0032"
          },
          {
            "a": "T1195.002",
            "c": 0.699999988079071,
            "d": "Top-level try/catch empty handler",
            "e": [
              "catch(e)\r\n\t{\r\n\t}"
            ],
            "i": "objectives/supply-chain/install-hook/dropper/obfuscation::top-level-try-catch-empty",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.699999988079071,
            "d": "Small file under 5KB",
            "e": [
              "20170416_defe03abd03bc238f28294c00d6d2a96.js"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "join() function wrapper",
            "e": [
              "return fuu1.join(fuu2);"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-join-wrapper",
            "l": 4
          },
          {
            "c": 0.949999988079071,
            "d": "Variable split and join concealment",
            "e": [
              ".split(lki)",
              "return fuu1.join(fuu2);"
            ],
            "i": "objectives/anti-static/obfuscation/string/conceal::js-variable-split-join-concealment",
            "l": 2
          }
        ],
        "sha": "dc26ebcac7f8a7676572c8a4320dc70a23fcf1fbd81504939bdb414b609844a5",
        "path": "20170416_defe03abd03bc238f28294c00d6d2a96.js",
        "type": "javascript"
      }
    ],
    "tv": "d376d"
  }
}